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(57) ABSTRACT 

A graphical user interface (GUI) is described which enables 
hierarchically structured information to be presented and 
analysed by a user quickly and easily. In one example, the 
GUI is for a fraud management system and the information 
is about "alarms". Each alarm is an indicator of potential 
fraud and several types of alarm are presented, where the 
type of an alarm depends on the method of obtaining that 
alarm. The types of alarm are arranged in a hierarchical 
structure and a representation of the hierarchical structure is 
displayed on a display screen. A user is able to select one or 
more parts of the hierarchical structure in order to display 
information about all the alarms of the selected types and 
subtypes. This enables the user to quickly and easily view 
required information without the need to make many user 
actions and selections. The representation of the hierarchical 
structure may be tailored by the user. This is done by 
collapsing or expanding parts of the hierarchical represen- 
tation. 
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GRAPHICAL USER INTERFACE AND 
METHOD FOR DISPLAYING 
HIERARCHICALLY STRUCTURED 
INFORMATION 

BACKGROUND OF THE INVENTION 

1. Field of the Invention 

This invention relates to a graphical user interface (GUI) 
and in particular, but not limited to a GUI for a fraud 
management system. 

2. Description of the Prior Art 

A GUI provides a means by which a user can control an 
apparatus such as a computer system. The GUI is typically 
also the means by which information about or from the 
apparatus is presented to the user. 

A particular problem for GUIs involves providing an 
interface which can present large amounts of information to 
a user in such a way that the user can quickly and easily 
obtain the required information. The GUI should be easy to 
learn and flexible in order that a user may "tailor" displays 
to meet particular requirements. These problems occur par- 
ticularly where the information to be presented is of several 
types which can be organised into a hierarchical structure. 

The GUIs provided as part of Microsoft Outlook™ and 
Microsoft Windows Explorer™ have attempted to address 
these problems by presenting displays which illustrate the 
hierarchical structure of stored information. For example, in 
Microsoft Windows Explorer a display of icons is presented 
in a "tree" structure form where the leaves of the tree 
represent individual documents and branches of the tree 
represent folders for containing documents. However, when 
a user selects an icon representing a branch of the tree, 
information about each leaf of the tree stemming from that 
branch is not necessarily presented. In order for the user to 
view information about all documents at that level and 
below in the hierarchy several key presses or other user 
actions are required. This is time consuming and repetitive 
for the user and can lead to novice users being unable to find 
the information that they require. A similar problem is 
encountered with Microsoft Outlook. 

Fraud management systems are typically used to analyse 
data about events such as credit card transactions or tele- 
phone calls, in order to detect potentially fraudulent events. 
These potentially fraudulent events are identified for 
example using rule based methods, neural networks, or other 
suitable techniques. Often a combination of different tech- 
niques are used and the results compared. This leads to the 
situation where a given event may be detected as potentially 
fraudulent using several different methods within a fraud 
management system and several different "alarms" or 
"alerts" are raised to notify an operator of the fraud man- 
agement system. Several lens of different methods may be 
used to identify potentially fraudulent events especially for 
telecoms fraud. For example, particular situations may be 
identified as potentially fraudulent such as if the total cost of 
calls rapidly increases on a particular customer account, or 
if simultaneous calls occur from the same customer account 
(this is not possible under normal circumstances). This 
means that the number of types of "alarms" or "alerts" is 
great. As well as this the number of instances of alarms can 
be large especially because telecoms fraud such as mobile 
telephone fraud is a growing problem. 

Ihe operator of a fraud management system is thus 
provided with many "alarms" as outputs from the system 
and needs to analyse these and decide what action to take. 
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2 

For example, one or more "alarmed" events such as tele- 
phone calls may be related in that they are all calls to the 
same destinations, or are all calls to one another. Once an 
account that is being used fraudulently has been identified 

5 the owner, who may well be aware of this, is typically 
contacted and provided with a new account. Once a fraudu- 
lent account has been identified action needs to be taken 
quickly in order to minimise any losses incurred. 

It is therefore important for a GUI to be provided to a 

JO fraud management system which is simple and easy to use 
and yet which is able to provide a user with all the func- 
tionality he requires. Before now, such GUIs for fraud 
management systems have not been able to cope well with 
the large number of potential "alarms" and the large number 

is of types of alarms. Typically a user has had to move or 
change between different windows or displays within a GUI 
in order to seek all the information he requires. This is time 
consuming and complex making such GUIs difficult to learn 
especially for novices in the field of fraud management 

20 systems. Another problem with known GUIs for fraud 
management is that they are inflexible and cannot easily be 
used by an operator to provide a display tailored for a 
particular task or situation. Also, different types of alarm 
have been treated differently and this has meant that a user 

25 has had to make several "clicks" or selections in order to 
reach the information required. 

It is accordingly an object of the present invention to 
provide an improved GUI which overcomes or at least 
mitigates one or more of the problems noted above. 

30 

SUMMARY OF THE INVENTION 

According to the present invention there is provided a 
method of controlling a display for displaying hierarchically 
structured information, the hierarchy having at least two 
35 levels, said method comprising the steps of: 

(i) displaying a representation of at least part of the 
hierarchy; 

(ii) receiving user input to make a selection of part of the 
hierarchy, at a given one of the levels in the hierarchy; 

40 and 

(iii) displaying information located within the selected 
part of the hierarchy including information located two 
or more levels below the level of the selection, in 
response to the selection. 

45 A corresponding computer program stored on a computer 
readable medium is provided, said computer program being 
for controlling a display for displaying hierarchically struc- 
tured information, the hierarchy having at least two levels, 
said computer program being arranged to control said dis- 

50 play such that: 

(i) a representation of at least part of the hierarchy is 
displayed; 

(ii) a user input is received, to make a selection of part of 
5S the hierarchy, at a given one of the levels in the 

hierarchy; and 

(iii) information is displayed within the selected part of 
the hierarchy, including information located two or 
more levels below the level of the selection, in response 

60 to the selection. 

A corresponding graphical user interface is provided for 
controlling a computer system, said graphical user interface 
comprising: 
(i) a display screen; 
65 (ii) a user input means; and 

(iii) a processor arranged to display hierarchically struc- 
tured information from the computer system on the 
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display screen, the hierarchy having at least two levels Further benefits and advantages of the invention will 

and said processor being arranged to control the display become apparent from a consideration of the following 

of information on the display screen by: detailed description given with reference to the accompa- 

(i) displaying a representation of at least part of the ny i n g drawings, which specify and show preferred embodi- 
hierarchy; 5 ments 0 f t h e invention. 

(ii) receiving a user input to make a selection of part of 

the hierarchy, at a given one of the levels in the BRIEF DESCRIPTION OF THE DRAWINGS 
hierarchy; and 

(iii) displaying information located within the selected FIG * 1 shows an account manager display screen. 

part of the hierarchy, including information located FIG. 2 shows the account manager display screen with an 

two or more levels below the level of the selection, account menu pulled down. 

in response to the selection. $\q 3 shows an alarm marjag er display screen. 

This provides the advantage that an improved GUI is nir , A „ u ~.,.„ *u 1 j- 1 1 

. , . , , , 6 . , , i -i 1 . FIG. 4 shows the alarm manager display screen of FIG. 3 

created, Hie user is able to quickly and easily select par- ..... . , # c _ , » , j 

. _ cu- u- 11 * * a • e -.iT * with the absolute feature use alarm type expanded, 

ticular parts of hierarchically structured information without J r r 

needing to make several actions or selections. Use of a 15 FIG. 5 shows the alarm manager display screen of FIG. 3 

hierarchical representation enables the user to gain an over- ^ a " me " menu P uJled down - 

all view of the structure of the items and to select required FIG- 6 shows the alarm manager display screen of FIG. 3 

information from a single display screen. For a given level with an "alarm type" menu pulled down and "all alarms" 

in the hierarchy all information located two or more levels selected. 

below that level is presented as a result of a single user 20 FIG. 7 shows the alarm manager display screen of FIG. 6 

action. The resulting GUI is simple to use and easy to learn. with an "alarm" menu pulled down instead of the "alarm 

The present invention also provides a fraud management type" menu, 

system comprising: p IG g shows the alarTn manager display screen of FIG. 7 

(i) a display screen; ^ with an alarm being validated as correct. 

(ii) user input means; FIG. 9 shows the alarm manager display screen of FIG. 3 

(iii) a processor arranged to display hierarchically struc- with "behavioural alarms" selected. 

tured information from the fraud management system FIG. 10 shows an alarm manager display screen which is 

on the display screen, said information comprising a S p|j t mt0 p arts 

plurality of alarms each alarm being an indicator of in , c . , 

r A . J . . , . . . . , 30 FIG. 11 shows a fraud management system. 

potential fraud, said hierarchy having at least two „ * i 

levels, said processor being arranged to control the ^ * a flow steps for controlling the 

display of information on the display screen by: d ^ of i nfori ^on by a GUI. 

(i) displaying a representation of at least part of the DETAILED DESCRIPTION OF THE 
hierarchy on the display screen; 35 INVENTION 

(ii) receiving a user input to make a selection of part of 

the hierarchy at a given one of the levels in the Embodiments of the present invention are described 

hierarchy; and below by way of example only. These examples represent 

(iii) displaying information located within the selected the best wavs of Pitting the invention into practice that are 
part of the hierarchy, including information located 40 currently known to the Applicant although they are not the 
two or more levels below the level of the selection, onl y wavs in which tnis could be achieved. 

in response to the selection. The term "alarm" is used to refer to a potentially fraudu- 

This provides the advantage that an improved GUI for a lent event that has been identified as such by a fraud 

fraud management system is created. The user is able to management system. 

quickly and easily select information about different alarms 45 The term "fraud management system" is used to refer to 

without needing to make several actions or selections. Use any type of automated method that is suitable for analysing 

of a hierarchical representation enables the user to gain an information about events and identifying potentially fraudu- 

overall view of the structure of the alarms and to select lent events. 

required information from a single display screen. For a Trie present invention relates to a graphical user interface 

given level in the hierarchy information located two or more 50 (GUI). The GUI provides a means by which a user or 

levels below is presented as a result of a single user action. operator can control a system such as a fraud management 

The resulting GUI is simple to use and easy to learn. S y S tcm. The GUI is the means through which information is 

According to another aspect of the present invention there presented to the user and user inputs are made to the fraud 

is provided a method of operating a display for displaying management system or other system in order to control it. 

hierarchically structured information, the hierarchy having 55 suitab i e system can be usecL For example, the mobile 

at least two levels, said method comprising the steps of: telephone fraud management system described in pending 

(i) causing a representation of at least part of the hierarchy U.S. patent application Ser. Nos. 08/869,884; 08/872,332; 
to be displayed; and 08/888,361. 

(ii) making a user input to select part of the hierarchy at FIGS. 1 to 10 arc examples of display screens produced 
a given one of the levels in the hierarchy; and eo by a GUI for use with a fraud management system. FIGS. 1 

(iii) causing information to be displayed within the to 2 are examples of display screens from part of the GUI 
selected part of the hierarchy, including information which is termed an "account manager" and FIGS. 3 to 10 are 
located two or more levels below the level of the examples of display screens from another part of the GUI 
selection, in response to the selection. which is termed an "alarm manager". 

r I nis enables a user to quickly and easily operate a display 65 Account Manager 

in order to obtain information that he or she requires without FIG. 1 shows an account manager display screen 10 

having to make many user inputs. which contains a list of four accounts 11, 12, 13, 14 details 
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for an individual account being displayed in one row of a 
table-like display. Two of these accounts 13, 14 have been 
allocated to a particular user and this is indicated by the 
presence of an identifier "albu" in a column 15 labelled 
"ID". The other accounts 11, 12 have no such entry in the ID 
column 15 and have not yet been allocated to a particular 
user. Once an account has been allocated to a particular user, 
other users are not able to modify the records for this 
account. 

The next column 16 contains an icon the colour of which 
indicates whether the particular account has been verified as 
fraudulent or not and a date column contains information 
about the date on which any verification information was 
entered into the fraud management system. 

Another column 17 contains an icon which looks similar 
to a case or folder. This indicates whether a case history is 
being stored for the particular account by the fraud man- 
agement system. 

For each account, an account identifier is displayed in 
column 18. The account identifier is a three digit number or 
any other suitable identifier, for example, which may be 
non-numeric. 

An icon 19 is used to indicated that a potential roamer 
(which is an indicator of a type of fraudulent activity) has 
been detected and the type of account is given in another 
column 20. For example, a particular account may be a 
business account or an account for a GSM phone. 

A score is also given in column 21. This provides an 
indication of priority and helps operators of the fraud 
management system to decide which cases to take action for 
first. For each account, icons are provided to indicate which 
types of alarm were detected for that account. These icons 
are located under the "alarm types" column 23. 

At the top of the display a menu bar 24 is provided 
together with a so called "tool bar" or bar of icons 25. 

Once a user has deleted all alarms for a particular account, 
information about that account on the account manager 
display screen 10 is given in dotted text rather than solid 
text. Once the screed is "refreshed" this dotted text is 
remove. For example, see row 13. Also, a second table 26 or 
list of accounts is provided towards the bottom of the display 
10. This contains details of the accounts allocated to a 
particular user, for example "albu" in the example shown in 
FIG. 1. It is not essential to provide a second table 26, but 
this is useful, especially when several users are working 
using the account management display from separate termi- 
nals of a networked computer system, Each particular user 
is then provided with their own "working area" each of 
which are formed by a second table 26. 

The FILTER menu can be used from menu bar 24 in order 
to filter out all accounts of a certain type or age and then the 
remaining accounts are displayed in the first table-like 
display. The format of the second table 26 is the same as for 
the first table and is placed below but in register with the first 
table for ease of comparison. 

In order to view further details about an individual 
account that account is selected using a "mouse", keyboard 
or other selection means as is known in the art. For example, 
in FIG. 2, account 14 has been selected and is shaded in 
colour as compared to accounts 11 to 13. The ACCOUNT 
menu from menu bar 24 may then be selected, as shown in 
FIG. 2, and the command ALARM MANAGER activated. 
This results in an alarm manager display screen being 
displayed as well as the account manager display 10. 

Instead of using the ACCOUNT menu in this way to open 
the alarm manager display, the user is also able to double 
click or select account 14 in any other suitable way in order 
to achieve the same effect. 
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Alarm Manager 

FIG. 3 shows an example of an alarm manager display 
screen 30. This has a menu bar 31 and a toolbar 32 similar 
to those of the account manager display screen 10. The 

5 column headings 33 from the list or table of accounts in the 
account manager display is given, together with the infor- 
mation about the selected account 14 from the account 
manager window. This acts as a reference for the user to 
enable him or her to quickly identify the account being 

30 analysed. Details of when the account was first active, when 
it was last active and when the first and last alarms were 
shown for it are also given in the display. 

The remaining part of the display is divided into two 
portions or columns 34, 35. One column 35 is shown empty 

15 in FIG. 3 and is for displaying information about individual 
"alarms". The other column 34 contains a display in the form 
of a tree structure or other hierarchical structure. This 
displays a number of icons, for different types of alarm and 
connects these together in a hierarchical fashion. A different 

20 icon is used for each type of alarm. At the base of the tree 
structure is an icon labelled ALL ALARMS and opposite 
this a figure is displayed which indicates the total number of 
alarms for the account 14 being analysed. 
As discussed above, an alarm is a potentially fraudulent 

25 event that has been identified as such by the fraud manage- 
ment system. There are several different types of alarm 
according to the method used to identify the potentially 
fraudulent event. For example, potentially fraudulent events 
identified by a neural network based method as termed 

30 "behavioural alarms" in the example being discussed and 
potentially fraudulent events identified by other methods are 
termed "first line defence" alarms. Thus for a given event, 
several different alarms may be generated of different types. 
A hierarchy of alarms is formed by allocating some types 

35 of alarms as being subtypes. For example, by creating the 
type "behavioural alarms" all types of alarms which result 
from analysis by a neural network based method become 
subtypes of the "behavioural alarm" type; each of these 
subtypes then has supertype which is the type "behavioural 

40 alarm". Various different forms of hierarchy can be formed 
with subtypes being members of one or more supertypes for 
example. The subtypes and supertypes form different levels 
in the hierarchy and individual alarms which are contained 
within a type comprise information within that type or level 

45 of the hierarchy. Thus a hierarchy with only two levels 
comprises for example a supertype "behavioural alarms" 
and its subtype "expected alarms". Within the supertype 
"behavioural alarms" there may also be a number of alarms 
which are not members of the type "expected alarms". These 

50 alarms comprise information within the "behavioural 
alarms" level. Within the subtype "expected alarms" there 
may be one or more individual alarms which comprise 
information within the "expected alarms" level. 

In a preferred embodiment the hierarchy is a tree structure 

55 where each subtype has only one direct supertype. Each 
individual alarm can be thought of as a leaf on this tree. 

In the case that the GUI is used for a system other than a 
fraud management system any items of data that arc of 
different types may be used in place of the alarms. These 

60 items of data are then formed into a hierarchy as described 
above for alarms. Any information that is structured hierar- 
chically can be used. 

In previous GUIs for fraud management systems and 
other systems it has not been possible for users to quickly 

65 and easily view details of alarms or other items of different 
types simultaneously on the same display, or to quickly 
change views to show different parts of hierarchically struc- 
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tured information. Typically this has involved several suc- 
cessive selection actions by the user which are time 
consuming, repetitive and difficult to learn by novice users 
of the GUI. 

This problem is addressed in the present invention by 
provision of a representation of at least part of a hierarchy 
on a single display and allowing a user to find and present 
information in the hierarchy by selecting a part or parts of 
the representation. For example, FIG. 3 shows bow a num- 
ber of icons, connected together to form a "tree", are 
displayed to represent the hierarchical structure of alarm 
types. 

When a part of the representation is selected, such as an 
icon representing behavioural alarms, information about all 
members of the behavioural alarms type, including members 
of its subtypes is presented. That is, if a branch in the 
representation of the tree structure is selected by a user, then 
information about all the alarms which are leaves connected 
to that branch are displayed. This is described in more detail 
below. However, it is also possible to arrange the GUI such 
that when a part of the representation is selected, such as an 
icon representing behavioural alarms, information about all 
alarms that are two or more levels below the level of the 
selection are presented. Similarly, information about alarms 
that are from multiple different levels below the level of the 
selection may be presented. 

When a branch in the representation of the tree structure 
is selected by a user information within the selected part of 
the hierarchy is displayed. The selected part of the hierarchy 
is the branch and all subtypes and leaves connected to that 
branch. 

Referring again to FIG. 3, connected directly to the ALL 
ALARMS icon are two branches, one to a BEHAVIOURAL 
ALARM icon and one to a FIRST LINE DEFENCE (FLD) 
alarms icon. As before, opposite each icon a figure is 
displayed which indicates the total number of alarms of the 
appropriate type that are associated with the account 14 
being analysed. In the example given in FIG. 3 there are 3 
behavioural alarms and 68 FLD alarms, giving a total of 71 
which tallies with the number given next to ALL ALARMS. 
Next to the BEHAVIOURAL ALARMS icon a small minus 
sign is given. This indicates that all the branches and leaves 
of the tree which stem from the BEHAVIOURAL ALARMS 
icon are currently displayed. In this case these include a 
FRAUD ALARMS icon and an EXPECTED ALARMS 
icon. These icons also have numbers adjacent them which 
sum to give the number of behavioural alarms (i.e. in this 
case 3). 

The small minus sign may be selected by the user, by 
clicking on it with a mouse for example, in order to collapse 
this part of the display i.e. to hide the FRAUD ALARMS 
icon and EXPECTED ALARMS icon. Once these icons are 
hidden the minus sign changes to a + sign to indicate that 
some levels of the tree structure are currently hidden from 
view. For example, next to the fraud alarms icon a + sign is 
given indicating that there are different types of fraud alarms 
which can be displayed. 

One of the icons stemming from the FLD alarms icon is 
an icon labelled ABSOLUTE FEATURE USE. The result of 
clicking on the + sign next to this icon is illustrated in FIG. 
4. Here six further icons are displayed, all stemming from 
the ABSOLUTE FEATURE USE icon and a minus sign is 
now given instead of a + sign next to the ABSOLUTE 
FEATURE USE icon. Apart from this FIG. 4 is the same as 
FIG. 3. 

Thus it is possible for the user to collapse or expand parts 
of the hierarchical representation in order to tailor that 



representation to his or her requirements. This aids the user 
in his or her search for required information. Also, because 
the hierarchical representation is displayed on a single 
display screen the user does not need to make repeated 

5 actions in order to open new "windows'* or change the 
display show new types of alarms. The user is able to select 
parts of the hierarchical representation in order to display 
information about the types of alarms that are required. This 
reduces the number of selections and actions required by the 

10 user in order to display required information; the user is 
quickly and simply able to view the structure of the alarm 
types from the hierarchical representation and this simplifies 
the GUI and makes it easier to use. 

FIG. 5 shows the commands 51 that are available when a 

15 file menu is selected from the menu bar 31. These include 
the following commands: 



ACCOUNT MANAGER 
CALL DETAILS QUERY 
LAST ACTIVE BEHAVIOUR 
ALLOCATE 
UN-ALLOCATE 
ACTION 
EXPORT CASE 
REMOVE CASE 

HIGHLIGHT IN OTHER WINDOWS 
PRINT 

CLEAR ALL ALARMS 
EXPAND ALL 
COLLAPSE ALL 
CLOSE 



20 



25 



30 



35 



45 



50 



55 



60 



65 



Of these the EXPAND ALL and COLLAPSE ALL com- 
mands are used to change the hierarchical structure display 
in a manner so as to show all super and subtypes or to hide 
all subtypes. 

FIG. 6 shows the alarms window when a user has selected 
the ALL ALARMS icon from the hierarchical representa- 
tion. Once the user selects this icon, for example, by using 
a mouse or other suitable input device, then this icon is 
shaded to indicate that it has been selected. In the example 
shown in FIG. 6 the display indicates that 71 ALL ALARMS 
are available for this customer account. Once the ALL 
ALARMS icon has been selected information about each of 
these alarms is displayed in the column 35 opposite the 
hierarchical display. For each alarm, an icon is displayed in 
a column 62 labelled "ALARM" and these icons indicate the 
type of each alarm. As well as this, a time stamp is given for 
each alarm, in another column 63. The time stamp indicates 
the date and time at which the alarm occurred. 

FIG. 6 also shows the result of selecting the ALARM 
TYPE menu from the menu bar 31. 'I "he commands available 
on this ALARM TYPE menu include: EXPAND, 
COLLAPSE, CLEAR ALL ALARMS and CONFIGURE. 

FIG. 7 shows the result of selecting the ALARM menu 
from menu bar 31. Once a particular alarm is selected in 
column 35, for example, by the user clicking on an alarm 
using a mouse, then the ALARM menu can be used to delete 
or clear this alarm using the command CLEAR ALARM. 
Similarly the selected alarm can be validated by activating 
the VALIDATE alarm from the ALARM menu. FIG. 8 
shows this in more detail. When the VALIDATE command 
is chosen, three further options 80 are displayed. The user is 
able to select one of these options to indicate whether the 
selected alarm 81 is CORRECT, INCORRECT or whether 
the validation for that alarm should be cleared (deleted). By 
choosing the BEHAVIOUR command from the ALARM 
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menu further information is displayed to enable the user to 
investigate the behaviour of the individual alarm in more 
detail. 

For each alarm, information about the type of alarm and 
a time stamp for that are alarm arc available. However, for 5 
different types of alarm, additional information is available 
according to the type of alarm. For example, FIG. 9 illus- 
trates the result of selecting the BEHAVIOURAL ALARMS 
icon from the hierarchical display in column 34. In the 
example shown in FIG. 9 three BEHAVIOURAL ALARMS 10 
are present and information about these is presented in 
column 35. Information for an individual alarm is presented 
in a single row of a table-like display. The first column of the 
table 91 contains icons representing the type of each alarm. 



lower window, for example, "PRS, 8 hours" and display 
information about these first level defence alarms in the 
lower window. In this case the problem of different formats 
of information between the upper and lower window is 
avoided and it is possible to present all the information. 

The GUI can also be arranged to allow the "mix and 
match" capability that is described above for both the upper 
and lower windows. 

The method described above for controlling the display of 
hierarchically structured information by the GUI is prefer- 
ably implemented in the form of a computer program using 
conventional programming techniques as are known in the 
art. FIG. 12 is a flow diagram of the steps followed by the 
computer program. These include displaying a representa- 
tion of at least part of the hierarchy on a display screen (box 



The next I column i 92 gives the lime stamps and another is 1001 of F , G n) ^ a usef ; {s ^ 



column 93 provides a percentage value for each alarm, 
indicating the amount of certainty that the fraud manage- 
ment system has assigned to that alarm. Several further 
pieces of information are presented, again in a table -like 
format 94. 20 

In the case that a supertype is selected from the hierar- 
chical representation, a problem can arise if the information 
to be presented for the individual alarms of the associated 
subtypes is of incompatible formats. For example, in the 
case that ALL ALARMS is selected, as illustrated in FIG. 6, 25 
information must be presented about 3 behavioural alarms as 
well as the first line defence alarms. The behavioural alarms 
have been obtained from a neural network based fraud 
detector and the information associated with these alarms is 
of a different amount, format and type from that from say, 30 
the first line defence alarms. However, the display in column 
35 needs to present information about both these types of 
alarms. In order to do this, information which has a common 
format for all the types of alarms concerned is selected and 
presented. This provides the advantage that the GUI is able 35 
to cope with heterogeneous information about different 
types of alarms and which has been obtained using different 
methods. 

It is also possible for the user to select more than one part 
of the hierarchical display at one time. For example, this is 40 
required when the user desires to view information about 
say, "expected alarms" and "overlapping calls alarms". In 
such a situation, information which has a common format 
for all the types of alarms concerned is selected and pre 



part of the hierarchical representation at a given level in the 
hierarchy (box 1002 of FIG. 12). Then information is 
displayed, within the selected part of the hierarchy, includ- 
ing information located two or more levels below the level 
of the selection, in response to the selection (box 1003 of 
FIG. 12). 

FIG. 11 shows a fraud management system comprising: 

(i) a display screen 150; 

(ii) user input means 151; and 

(iii) a processor 152 arranged to display hierarchically 
structured information from the fraud management 
system on the display screen, said information com- 
prising a plurality of alarms each alarm being an 
indicator of potential fraud, said processor being 
arranged to control the display of information on the 
display screen by: 

(i) displaying a representation of at least part of the 
hierarchy on the display screen; 

(ii) receiving a user input to make a selection of part of 
the hierarchy at a given on eof the levels in the 
hierarchy; and 

(iii) displaying information within the selected part of 
the hierarchy, including information located two or 
more levels below the level of the selection, in 
response to the selection. 

The display screen may be of any suitable type such as a 
computer screen. The user input device may be a computer 
mouse, keyboard or other suitable input device as is known 



sented in the column 35. In this way the user is effectively 45 in the arl - ^ processor may be a conventional general 



able to "mix and match" the types of alarms for which 
information is presented on a single display screen. 

FIG. 10 illustrates the ability to divide or split the display 
screen into two effectively independent parts or windows 
100, 101. In each of these windows two columns are 50 
provided 105, 104, 103, 102 so that each window has the 
same format as the main part of an alarm window 30 in FIG. 
9. The display screen may be split into more than two 
effectively independent parts or windows in a similar way. 

In each of the two windows, one of the columns 105, 103 55 
contains a display of the hierarchical structure of alarm 
types. However, these may be collapsed or expanded inde- 
pendently of one another as a result of user inputs. When 
part of the hierarchical structure is selected by the user, 
information about all alarms at that part of the structure or 60 
below are displayed in the corresponding other column 104, 
102 in the same way as when the display is not split. 

As illustrated in FIG. 10 the user may select one type of 
alarm from the upper window for example, "period 1 fraud 
alarms" and enable information about these behavioural 65 
alarms to be displayed in the upper window. At the same 
time, the user can select another type of alarm from the 



purpose computer or any suitable information processing 
apparatus. 

A range of applications are within the scope of the 
invention. These include situations in which it is required to 
provide a graphical user interface for a fraud management 
system or other system, and for displaying information in a 
hierarchical form. Situations where it is required to mini- 
mise the number of user actions required to select and 
display parts of the hierarchical information and also within 
the scope of the invention. 

What is claimed is: 

1. A method of displaying hierarchically structured 
information, the hierarchy having at least two levels, the 
method comprising: 

(i) displaying a first representation of at least part of the 
hierarchy; 

(ii) receiving a first user input associated with the first 
representation to make a first selection of at least part 
of the hierarchy, at a given one of the levels in the 
hierarchy; 

(iii) in response to the first selection, displaying informa- 
tion located within the first selected part of the 
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hierarchy, including information located two or more 12. A method as claimed in claim 7, wherein displaying 

levels below the level of the first selection; and information located within the first selected part of the 

(iv) displaying a second representation of at least part of hierarchy comprises only displaying information of a com- 

the hierarchy, the second representation being indepen- mon format. 

dent of the first representation, the second representa- 5 13- A method as claimed in claim 7, further comprising 

tion including at least some information having a displaying a second representation of at least part of the 

different format than information displayed in the first hierarchy, the second representation being independent of 

representation. the first representation. 

2. A method as claimed in claim 1 wherein displaying 14. A method as claimed in claim 13, further comprising 
information located within the first selected part of the 10 receiving a second user input associated with the second 
hierarchy comprises only displaying information of a com- representation to make a second selection of at least part of 
mon format. the hierarchy, at a given one of the levels in the hierarchy; 

3. A method as claimed in claim 1, wherein displaying an d } i n response to the second selection, displaying infor- 
information located within the first selected part of the mation located ^thin the second selected part of the 
hierarchy further comprises displaying information located hierarchy, including information located two or more levels 
at all levels below the level of the first selection below tfae levd of the second ^baton. 

4. A method as claimed m claun l, wherein ^playing 15 A method of ^ { . hier archically structured 
information ocated within the first selected part of he Mormationy the nierarch P £j at least ^ levelSj the 
hierarchy further comprises displaying mformation located t , , . . 3 & 

at multiple different levels, method compnsing: 

5. A method as claimed in claim 1, further comprising 20 0) displaying a first representation of at least part of the 
receiving a second user input associated with the first hierarchy; 

representation to make a second selection of at least part of (ii) receiving a first user input associated with the first 

the hierarchy, at a given one of the levels in the hierarchy; representation to make a first selection of at least part 

and, in response to the second selection, displaying infor- of the hierarchy, at a given one of the levels in the 

mation located within the second selected part of the 2 5 hierarchy; 

hierarchy, including information located two or more levels (iii) in response to the first selection, displaying informa- 

below the level of the second selection. tion locate d within the first selected part of the 

6. A method as claimed m claim 1, further comprising hierarchy, including information located two or more 
receiving a second user input associated with the second levels below the level of the first selection, wherein said 
representation to make a second selection of at least part of 30 information comprises a plurality of alarms each of 
the hierarchy, at a given one of the levels in the hierarchy; wnich ^ an ind i ca tor of potential fraud. 

and, in response to the second selection, displaying infor- 16 A method ^ claimed in claim 15, wherein displaying 

mation located within the second selected part of the information located within the first selected part of the 

hierarchy, including information located two or more levels hierarchy further comprises displaying information located 

below the level of the second selection. 35 at aU levels below the levd of the first selection. 

7. A method of displaying hierarchically structured 17. A method as claimed in claim 15, wherein displaying 
information, the hierarchy having at least two levels, the information located within the first selected part of the 
method comprising: hierarchy further comprises displaying information located 

(i) displaying a first representation of at least part of the al multiple different levels. 

hierarchy; 40 18. A method as claimed in claim 15, further comprising 

(ii) receiving a first user input associated with the first receiving a second user input associated with the first 
representation to make a first selection of least part of representation to make a second selection of at least part of 
the hierarchy, at a given one of the levels in the the hierarchy, at a given one of the levels in the hierarchy; 
hierarchy; a nd, in response to the second selection, displaying infor- 

(iii) in response to the first selection, displaying informa- 45 mation located within the second selected part of the 
tion located within the first selected part of the hierarchy, including information located two or more levels 
hierarchy, including information located two or more below the level of the second selection. 

levels below the level of the first selection, wherein said 19. A method as claimed in claim 15, wherein at least 

information is from a fraud management system. some of the information is of different formats. 

8. A method as claimed in claim 7, wherein displaying 50 20. A method as claimed in 15, wherein displaying 
information located within the first selected part of the information located within the first selected part of the 
hierarchy further comprises displaying information located hierarchy comprises only displaying information of a com- 
at all levels below the level of the first selection. mon formal. 

9. A method as claimed in claim 7, wherein displaying 21, A method as claimed in claim 15, further comprising 
information located within the first selected part of the 55 displaying a second representation of at least part of the 
hierarchy further comprises displaying information located hierarchy, the second representation being independent of 
at multiple different levels, the first representation. 

10. A method as claimed in claim 7, further comprising 22. A method as claimed in claim 21, further comprising 
receiving a second user input associated with the first receiving a second user input associated with the second 
representation to make a second selection of at least part of 60 representation to make a second selection of at least part of 
the hierarchy, at a given one of the levels in the hierarchy; the hierarchy, at a given one of the levels in the hierarchy; 
and, in response to the second selection, displaying infor- and, in response to the second selection, displaying infor- 
mation located within the second selected part of the mation located within the second selected part of the 
hierarchy, including information located two or more levels hierarchy, including information located two or more levels 
below the level of the second selection. 65 below the level of the second selection. 

11. A method as claimed in claim 7, wherein at least some 23. A computer program stored on a computer readable 
of the information is of different formats. medium, said computer program displaying hierarchically 
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structured information, the hierarchy having at least two 
levels, said computer program comprising instructions oper- 
able to cause a processor to 

(i) display a first representation of at least part of the 
hierarchy; 5 

(ii) receive a first user input associated with the first 
representation to make a first selection of at least part 
of the hierarchy at a given one of the levels in the 
hierarchy; 

(iii) in response to the first selection, display information jo 
located within the first selected part of the hierarchy, 
including information located two or more levels below 
the level of the first selection; and 

(iv) display a second representation of at least part of the 
hierarchy, the second representation being independent 15 
of the first representation, the second representation 
including at least some information having a different 
format than information displayed in the first represen- 
tation. 

24. A computer program as claimed in claim 23, wherein 
display information located within the first selected part of 
the hierarchy further comprises display information located 
at all levels below the level of the first selection. 

25. A computer program as claimed in claim 23, wherein 
display information located within the first selected part of 
the hierarchy further comprises display information located 
at multiple different levels. 

26. A computer program as claimed in claim 23, com- 
prising further instructions operable to cause the processor 
to receive a second user input associated with the first 
representation to make a second selection of at least part of 
the hierarchy, at a given one of the levels in the hierarchy; 
and, in response to the second selection, display information 
located within the second selected part of the hierarchy, 
including information located two or more levels below the 
level of the second selection. 

27. A computer program as claimed in claim 23, com- 
prising further instructions operable to cause the processor 
to receive a second user input associated with the second 
representation of the hierarchy to make a second selection of 
at least part of the hierarchy, at a given one of the levels in 
the hierarchy; and, in response to the second selection, 
display information located within the second selected part 
of the hierarchy, including information located two or more 
levels below the level of the second selection. 

28. A computer program as claimed in claim 23, wherein 
display information located within the first selected part of 
the hierarchy comprises only display information of a com- 
mon format. 

29. A fraud management system comprising: 

(i) a display screen; 

(ii) user input means; 

(iii) a processor arranged to display information from the 
fraud management system on the display screen, said 
information comprising a plurality of alarms each 
alarm being an indicator of potential fraud, and wherein 
said alarms are hierarchically structured, the hierarchy 
having at least two levels, said processor being 
arranged to 

(i) display a first representation of at least part of the 60 
hierarchy; 

(ii) receive a first user input associated with the first 
representation to make a first selection of at least part 
of the hierarchy, at a given one of the levels in the 
hierarchy; 65 

(iii) in response to the first selection, display informa- 
tion within the selected part of the hierarchy, includ- 
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ing information about alarms located two or more 
levels below the level of the first selection. 

30. A system as claimed in claim 29, wherein display 
information located within the first selected part of the 
hierarchy further comprises display information located at 
all levels below the level of the first selection. 

31. A system as claimed in claim 29, wherein display 
information located within the first selected part of the 
hierarchy further comprises display information located at 
multiple different levels. 

32. A system as claimed in claim 29, the processor being 
further arranged to receive a second user input associated 
with the first representation to make a second selection of at 
least part of the hierarchy, at a given one of the levels in the 
hierarchy; and, in response to the second selection, display 
information located within the second selected part of the 
hierarchy, including information located two or more levels 
below the level of the second selection. 

33. Asystem as claimed in claim 29, wherein at least some 
of the information is of different formats. 

34. Asystem as claimed in claim 29, the processor being 
further arranged to display a second representation of at least 
part of the hierarchy, the second representation being inde- 
pendent of the first representation. 

35. Asystem as claimed in claim 34, the processor being 
further arranged to receive a second user input associated 
with the second representation of the hierarchy to make a 
second selection of at least part of the hierarchy, at a given 
one of the levels in the hierarchy; and, in response to the 
second selection, display information located within the 
second selected part of the hierarchy, including information 
located two or more levels below the level of the second 
selection. 

36. A system as claimed in claim 29, wherein displaying 
information located within the first selected part of the 
hierarchy comprises only displaying information of a com- 
mon format. 

37. A graphical user interface comprising: 

(i) display screen; 

(ii) a user input means; and 

(iii) a processor arranged to display information on the 
display screen, said information comprising a plurality 
of items each item being of a given type, said processor 
being arranged to 

(i) form a hierarchy of said items; 

(ii) display a first representation of the hierarchy on the 
display screen; 

(iii) receive a first use input associated with the first 
representation to make a first selection of at least part 
of the hierarchy, at a given one of the levels in the 
hierarchy; 

(iv) in response to the first selection, displaying infor- 
mation located within the first selected part of the 
hierarchy, including information located two or more 
levels below the level of the first selection; and 

(v) displaying a second representation of at least part of 
the hierarchy, the second representation being inde- 
pendent of the first representation, the second rep- 
resentation including at least some information hav- 
ing a different format than information displayed in 
the first representation. 

38. A graphical user interface as claimed in claim 37, 
wherein display information located within the first selected 
part of the hierarchy further comprises display information 
located at all levels below the level of the first selection. 

39. A graphical user interface as claimed in claim 37, 
wherein display information located within the first selected 
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part of the hierarchy further comprises display information (iv) causing a second representation of at least part of the 

located at multiple different levels. hierarchy to be displayed, the second representation 

40. A graphical user interface as claimed in claim 37, the being independent of the first representation, the sec- 
processor being further arranged to receive a second user °nd representation including at least some information 
input associated with the first representation to make a 5 having a different format than information displayed in 
second selection of at least part of the hierarchy, at a given llle flrsl representation. 

one of the levels in the hierarchy; and, in response to the 44 A melnod as claimed in claim 43, wherein causing 

second selection, display information located within the information to be displayed within the first selected part of 

second selected part of the hierarchy, including information the hierarchy further comprises causing .information located 

located two or more levels below the level of the second 10 *< a 1 levels below the Ievel of the first xlectl0n 10 bc 

selection. displayed. 

41. A graphical user interface as claimed in claim 37, the . 45 A . melnod as . cla,med ln c . lalm 43 ' wherein causin S 
processor being further arranged to receive a second user information to be displayed within the first selected part of 
input associated with the second representation of the hier- the hierarchy further comprises causing information located 
archy to make a second selection of at least part of the is at ™ hl P ]e ^ Knt levels 1 t ? be , dls P'ay«5- 

hierarchy, at a given one of the levels in the hierarchy; and, 46 A melnod 35 claimed » nclaim f urther comprising 

in response to the second selection, display information makm S a »?" entera ^associated with the first 

located within the second selected part of the hierarchy, representation to make a second selection of at least part of 

including information located two or more levels below the the hierarchy, at a given one of the levels in the hierarchy; 

level of the second selection. 20 and ' 10 res P° nse t0 ,he ^cond selection, causing information 

42. A graphical user interface as claimed in claim 37, 1°. be ^played within the second selected part of the 
wherein display information located within the first selected hierarchy, including information ocated two or more levels 
part of the hierarchy comprises only display information of bel ° w the le v el ° f ^ cond selection. 

a common format 47 ' A metnod as claimed in 43, wherein causing mfor- 

43. A method of operating a display for displaying hier- 25 mation 10 be flayed within the first selected part of the 
archaically structured information, the hierarchy having at hierarchy compnses causing only information of a common 

least two levels, said method comprising fol ™ at 10 te &SP^ : 

..... . , . 48. A method as claimed in claim 43, further comprising 

(i) causing a first representation of at least part of the making , usef entef a mput wilh the 

lerarc y to e isp aye , second representation to make a second selection of at least 

(ii) making a user enter a first input associated with the par t of the hierarchy, at a given one of the levels in the 
first representation to select at least part of the hierar- hierarchy; and, in response to the second selection, causing 
chy at a given one of the levels of the hierarchy; information located within the second selected part of the 

(iii) in response to the first selection, causing information hierarchy to be displayed, including information located two 
to be displayed within the first selected part of the 35 or more levels below the level of the second selection, 
hierarchy, including information located two or more 

levels below the level of the first selection; and * * * * * 
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